Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116800WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

Medium 6.2

In plain English

A medium-severity path traversal in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – before 29.5.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-r3jc-85h3-h7g2) vendor-advisory
Patch Commit patch
AVideo v29.5.0 Release Notes release-notes
VulnCheck Advisory: WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header third-party-advisory